Skip to main content
The HITECH Act Privacy and Security
What is the HITECH Act? On February 17, 2009 the American Recovery and Reinvestment Act of 2009 (ARRA, sometimes referred to as “the stimulus”) included provisions making significant improvement in the privacy and security standards for health information was signed into law by the federal government.
What is the HITECH Act? Included in this law is $19.2 Billion which is intended to be used to increase the use of Electronic Health Records (EHR) by physicians and hospitals; this portion of the bill is called, the Health Information Technology for Economic and Clinical Health Act, or HITECH Act.
HITECH Act is directed at Protected health information that is not secured by a technology standard that renders protected health information unusable, unreadable or indecipherable to unauthorized individuals.  Entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that access, maintain, retain, modify, record, store, destroy, or otherwise hold, use, or disclose unsecured protected health information.
HITECH Act Require patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured protected health information.
Why did the government pass the law? Paper information increase the risk of unauthorized accessed due to human factor risks leaving information on desk leaving information on printer/fax out where information can be viewed by cleaning people dumpster incidents unlocked file cabinets/drawers shared working areas
Why did the government pass the law? The HITECH Act defines a breach as an unauthorized acquisition, access, use or disclosure of protection which compromises the security or privacy of such information.  Medical privacy breaches continue to be a serious problem for healthcare. Some of the most highly respected healthcare organizations in the country still suffer data breaches, and new breaches make headlines regularly.
Why did the government pass the law? Improve patient care Increase patient safety  Simplify compliance in the US healthcare system Help cut costs in the long term Minimize errors Increase productivity Increase administrative efficiency  Doctors get quicker access to patient’s information Patient information can be shared between specialists, primary doctors, nurses on staff Quicker and more accurate diagnosis Better care and higher satisfaction  Research indicates that utilizing EHR would serve to:
Securing EHR Encryption is the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning to the data unless an individual uses a certain process or has a key  Destruction  secure information found in paper or electronic format  paper or other hard copy media must be shredded or destroyed  Electronic media is to be cleared, purged or destroyed. The U.S. Department of Health and Human Services (DHHS) identifies two methods for rendering “secured”:  consistent with National Institute of Standards and Technology (NIST) standards
Securing EHR Data at rest (i.e., data that resides in databases, file systems, and other structured storage methods) Data in motion (i.e., data that is moving through a network, including wireless transmission) Data disposed (i.e., discarded paper records or recycled electronic media) Data in use (i.e., data in the process of being created, retrieved, updated, or deleted)
What does the HITECH ACT mean to physicians and hospitals? Up to $44,000 in total incentives per physician under Medicare for “meaningful use” of EHR.  Physicians reimbursed by Medicaid can receive up to $63,500 based on state-defined guidelines.  Hospitals with high Medicare and Medicaid volumes could receive up to $11 million.  These incentives will be paid out over a 4 to 5 year period beginning in 2011.
How do physicians or hospitals qualify for HITECH Act Incentives? Use a “certified” EHR the act does not specify what “certification” will mean or who will provide certification.  Demonstrate “meaningful use” of an EHR  includes communication with patients and families (e.g. appointment reminders, access to lab results, etc.).  EHR must: use e-prescribing EHR must allow physicians to prescribe over the Internet  electronically exchange information  exchanges of clinical information with labs, hospitals, providers, and payers across the country (including Medicare and Medicaid)  submit   clinical quality measures a set of payer-specific quality measures  Specific requirements have not been issued yet, we do know that physicians must:
What happens if HITECH Act isn’t adopted by physicians or hospitals?  After 2015, further financial incentives will not be available and penalties will kick in.  There will be a 1% reduction in Medicare fees per year, up to 3% by 2017.
Summary What? Intended to be used to increase the use of Electronic Health Records (EHR) by physicians and hospitals.. Why? risk of unauthorized accessed Medical privacy breaches Patient information can be shared between specialists, primary doctors, nurses on staff Quicker and more accurate diagnosis Improve patient care Increase patient safety  Simplify compliance in the US healthcare system….. Securing EHR Data at rest  Data in motion  Data disposed  Data in use Methods Encryption Destruction Physicians and Hospitals Incentives  Qualifications  Consequences HITECH Act is clearly an ideal opportunity for physicians and hospitals that use EHRs effectively to be rewarded and to stimulate adoption for those who aren’t currently using EHRs.